自定义PE加载器加载dll
本帖最后由 htpidk 于 2020-7-18 16:06 编辑论坛上已经有了这方面的帖子，不过不能加载易语言写的dll，要正常加载易语言的dll需要HOOK一个函数，HOOK懒得自己写了，用了detours，具体看代码吧，源码里都注释了。
#include "stdafx.h"
#include <iostream>
#include <Windows.h>
#include "detours.h"
#pragma comment(lib,"detours.lib")
using namespace std;
DWORD __stdcall newgetmodulefilename(HMODULE,LPSTR,DWORD);
HMODULE g_hm;
char g_dllname={0};
DWORD (__stdcall *poldgetmodulefilename)(HMODULE,LPSTR,DWORD)=GetModuleFileNameA;
int _tmain(int argc, _TCHAR* argv[])
{
char dllname={0};
cout<<"请输入需要加载的dll名称：";
cin>>dllname;
//char* dllname="C:\\Users\\jason\\Desktop\\vsvs\\PELoaderDll\\Debug\\yiyuyan.dll";
strncpy(g_dllname,dllname,strlen(dllname));
FILE* hf=fopen(dllname,"rb+");
fseek(hf,0,SEEK_END);
long len=ftell(hf);
//cout<<len<<endl;
fseek(hf,0,SEEK_SET);
char *filebuffer=new char;
fread(filebuffer,len,1,hf);
fclose(hf);
///////////////////读取各种PE头/////////////////
PIMAGE_DOS_HEADER pdosh=(PIMAGE_DOS_HEADER)filebuffer;
PIMAGE_NT_HEADERS pnth=PIMAGE_NT_HEADERS(filebuffer+pdosh->e_lfanew);
int sectionnumber=pnth->FileHeader.NumberOfSections;
int imagebase=pnth->OptionalHeader.ImageBase;
int sectionalig=pnth->OptionalHeader.SectionAlignment;
int filealig=pnth->OptionalHeader.FileAlignment;
int imagesize=pnth->OptionalHeader.SizeOfImage;
int headersize=pnth->OptionalHeader.SizeOfHeaders;
int entry=pnth->OptionalHeader.AddressOfEntryPoint;
//cout<<sectionnumber<<"\t"<<imagebase<<"\t"<<sectionalig<<"\t"<<filealig<<"\t"<<imagesize<<"\t"<<headersize<<endl;
////////////////各个区段按照内存对齐粒度依次复制到申请的内存里/////////////////
PIMAGE_SECTION_HEADER psech=PIMAGE_SECTION_HEADER((int)pnth+sizeof(IMAGE_NT_HEADERS));
LPVOID membuffer=VirtualAlloc(NULL,imagesize,MEM_RESERVE|MEM_COMMIT,PAGE_EXECUTE_READWRITE);//直接申请可读可写可执行的内存，这样设置区段的内存属性时就省了分区段设置
memset(membuffer,0,imagesize);
memcpy(membuffer,filebuffer,headersize);
for(int i=0;i<sectionnumber;++i){
memcpy((char*)membuffer+psech->VirtualAddress,filebuffer+psech->PointerToRawData,(psech->Misc.VirtualSize>psech->SizeOfRawData)?psech->SizeOfRawData:psech->Misc.VirtualSize);
psech++;
}
g_hm=(HMODULE)membuffer;
////////////修复导入表///////////////////
PIMAGE_IMPORT_DESCRIPTOR pimh=PIMAGE_IMPORT_DESCRIPTOR((char*)membuffer+pnth->OptionalHeader.DataDirectory.VirtualAddress);
while(pimh->OriginalFirstThunk!=0 && pimh->FirstThunk!=0){//导入表结构体由一个内容全为0的IMAGE_IMPORT_DESCRIPTOR结构作为结束
char* dllname=(char*)membuffer+pimh->Name;
//cout<<dllname<<endl;
HMODULE dllhandle=GetModuleHandle(dllname);
if(dllhandle==0)
dllhandle=LoadLibrary(dllname);
PIMAGE_THUNK_DATA poritk=PIMAGE_THUNK_DATA((char*)membuffer+pimh->OriginalFirstThunk);
PIMAGE_THUNK_DATA ptk=PIMAGE_THUNK_DATA((char*)membuffer+pimh->FirstThunk);
while(poritk->u1.AddressOfData!=NULL){//IMAGE_THUNK_DATA是一个以0结尾的DWORD数组
if(poritk->u1.Ordinal&0x80000000)//最高位为1表示以序号方式导入
ptk->u1.Function=(DWORD)GetProcAddress(dllhandle,(LPCSTR)(poritk->u1.Ordinal&0x0000FFFF));
else{
PIMAGE_IMPORT_BY_NAME pbyname=PIMAGE_IMPORT_BY_NAME((char*)membuffer+poritk->u1.AddressOfData);
//cout<<pbyname->Name<<endl;
ptk->u1.Function=(DWORD)GetProcAddress(dllhandle,LPCSTR(pbyname->Name));
}
poritk++;
ptk++;
}
pimh++;
}
///////////////修复重定位表/////////////
PIMAGE_BASE_RELOCATION preloc=PIMAGE_BASE_RELOCATION((char*)membuffer+pnth->OptionalHeader.DataDirectory.VirtualAddress);
while(preloc->VirtualAddress!=NULL && preloc->SizeOfBlock!=NULL){
int number=(preloc->SizeOfBlock-8)/2;
WORD* poffet=(WORD*)((DWORD)preloc+8);
DWORD* paddress=NULL;
for(int i=0;i<number;++i){
if((poffet&0xF000)==0x3000){//最高位为3代表重定位类型
paddress=(DWORD*)((char*)membuffer+preloc->VirtualAddress+(poffet&0x0FFF));
//cout<<hex<<paddress<<endl;
//cout<<hex<<*paddress<<endl;
*paddress=*paddress+(DWORD)membuffer-imagebase;
//cout<<hex<<*paddress<<endl;
}
}
preloc=PIMAGE_BASE_RELOCATION((DWORD)preloc+preloc->SizeOfBlock);
}
/////////////调用dllmain///////////////
DetourTransactionBegin();
DetourUpdateThread(GetCurrentThread());
DetourAttach((PVOID*)&poldgetmodulefilename,newgetmodulefilename);
DetourTransactionCommit();
BOOL (__stdcall *pdllmain)(HMODULE,DWORD,LPVOID)=(BOOL (__stdcall *)(HMODULE,DWORD,LPVOID))((char*)membuffer+entry);
pdllmain((HMODULE)membuffer,DLL_PROCESS_ATTACH,0);
/*调用VC写的DLLMAIN正常，但是调用易语言写的DLL的DLLMAIN则失败，因为易语言的DLLMAIN里调用了getmodulefilename函数获取dll的名称，因为
内存加载DLL没有将DLL放到LDR链里去，所以会导致getmodulefilename函数获取DLL名称失败，最后导致调用DLLMAIN失败，因此如果要正常调用易语言
写的DLL的DLLMAIN就必须要HOOK getmodulefilename函数
*/
delete[] filebuffer;
system("pause");
return 0;
}
DWORD __stdcall newgetmodulefilename(HMODULE hm,LPSTR buffer,DWORD size){
DWORD len=0;
if(hm==g_hm){
strncpy(buffer,g_dllname,strlen(g_dllname));
return strlen(g_dllname);
}else{
len=poldgetmodulefilename(hm,buffer,size);
return len;
}
} 加载DLL有什么用处？或是说妙处? 用于什么场合？ 朱朱你堕落了 发表于 2020-7-18 17:20
加载DLL有什么用处？或是说妙处? 用于什么场合？
一般用于外挂辅助方面，可以作为一个辅助手段减少被检测风险 满满的干货，刚接触编程，努力啃一下 感谢分享
页:
[1]